⚠️ 🔍 Recorded Future Identity - Credential Exposure Importer
⚠️ Unpublished: This item is from a solution that is not yet published on Azure Marketplace or not installed in Content Hub.
🔍 Discovered: This item was discovered by scanning the solution folder but is not listed in the Solution JSON file.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | RecordedFutureIdentityV3 |
| Publisher | Recorded Future |
| Used in Solutions | Recorded Future Identity |
| Collection Method | CCF |
| Connector Definition Files | azuredeploy-v3.json |
Imports Recorded Future Identity credential exposure data into Microsoft Sentinel. Writes malware log exposures to RFI_MalwareLogs_V2_CL, credential dump exposures to RFI_CredentialDumps_V2_CL, and user lookup results to RFI_UsersLookupResults_V2_CL. For full installation details, see the readme.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
RFI_CredentialDumps_V2_CL |
? | ✓ | ? |
RFI_MalwareLogs_V2_CL |
? | ✓ | ? |
RFI_UsersLookupResults_V2_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and write permissions are required.
Custom Permissions:
- Azure Subscription: Monitoring Contributor and Log Analytics Contributor permissions required to deploy the Data Connectors infrastructure. Owner or Role Based Access Control Administrator required to deploy playbooks with automatic role assignment.
- Recorded Future API Token: A Recorded Future Identity API token is required to authorize the RFI Custom Connector used by the playbooks.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Step 1 — Deploy Data Connectors infrastructure
Deploys the shared Data Collection Endpoint (DCE), Data Collection Rules (DCRs), Log Analytics tables (RFI_MalwareLogs_V2_CL, RFI_CredentialDumps_V2_CL, RFI_UsersLookupResults_V2_CL), and this connector definition tile. Deploy this into the same resource group as your Log Analytics Workspace.
2. Step 2 — Deploy RFI-CustomConnector
The custom connector handles authentication towards the Recorded Future API. Deploy it once — it is shared by the playbooks.
3. Step 3 — Deploy playbooks
Deploy one or more of the search/lookup playbooks depending on your use case. See the readme for full deployment instructions, parameters, and post-deployment configuration.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊